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What is claimed is: 

1. A method of detecting bandwidth anomalies in a data communication 
system, the method comprising: 

receiving a first traffic waveform representing a time distribution 
of data volume in a first direction in said data communication 
system in a first period of time; 

producing a correlation value representing a correlation of said 
first traffic waveform with a reference waveform; and 

producing a bandwidth anomaly signal when said correlation 
value satisfies a criterion. 

2. The method of claim 1 wherein producing said bandwidth anomaly 
signal comprises producing said denial of service attack signal when 
said correlation value is less than a reference value. 

3. The method of claim 2 wherein producing said bandwidth anomaly 
signal comprises determining whether said correlation value is less 
than said reference value. 

4. The method of claim 1 further comprising receiving a second traffic 
waveform representing a time distribution of data volume in a second 
direction on said data communication system in a second period of 
time, and using said second traffic waveform as said reference 
waveform to produce said correlation value. 



5. 



The method of claim 1 further comprising generating said first traffic 
waveform in response to a first set of traffic measurement values. 
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6. The method of claim 5 wherein generating said first traffic waveform 
comprises subjecting said first set of traffic measurement values to a 
Discrete Wavelet Transform. 

5 

7. The method of claim 6 wherein subjecting said first set of traffic 
measurement values to said Discrete Wavelet Transform comprises 
using Haar wavelet filter coefficients in said Discrete Wavelet 
Transform. 

10 

8. The method of claim 6 wherein generating said first traffic waveform 
comprises causing said Discrete Wavelet Transform to produce a first 
component, said first component representing said first traffic 
waveform. 

15 

9. The method of claim 8 wherein producing said correlation value 
comprises correlating said first component with said reference 
waveform. 

20 10. The method of claim 8 further comprising using a processor circuit to 

generate said first traffic waveform and to correlate said first traffic 
waveform with said reference waveform. 

11. The method of claim 1 wherein said first traffic waveform represents a 
25 statistical measure of a time distribution of data volume in said first 

direction. 
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12. 



The method of claim 5 further comprising monitoring data in said first 
direction and producing said first set of traffic measurement values in 
response thereto. 
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The method of claim 12 wherein producing said first set of traffic 
measurement values comprises producing values representing a 
property of an Ethernet statistics group in a remote monitoring protocol. 

The method of claim 13 further comprising causing a processor circuit 
operable to produce said first traffic waveform to communicate with a 
communication interface to receive said values representing said 
property of an Ethernet statistics group. 

The method of claim 12 wherein monitoring said data in said first 
direction comprises at least one of: counting packets and counting 
octets, in said first direction. 

The method of claim 15 further comprising causing a processor circuit 
operable to produce said first traffic waveform to communicate with at 
least one of a packet counter and an octet counter to receive values 
representing said first set of traffic measurement values. 

The method of claim 16 further comprising causing said processor 
circuit to implement at least one of said packet counter and said octet 
counter. 

The method of claim 12 further comprising passively monitoring said 
data in said first direction. 

A data communication method comprising transmitting and receiving 
data from a data communication system, the data communication 
system method of claim 12 and further comprising signaling an 
operator in response to said bandwidth anomaly signal. 

A data communication method comprising transmitting and receiving 
data from a data communication system, the data communication 
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system method of claim 12 and further comprising controlling at least 
one of transmission and reception of data from said data 
communication system in response to said bandwidth anomaly signal. 



5 21. The method of claim 4 further comprising generating said first and 

second traffic waveforms in response to first and second sets of traffic 
measurement values, representing traffic in said first and second 
directions on said data communication system, respectively. 

10 22. The method of claim 21 wherein receiving said first and second traffic 

waveforms comprises receiving first and second waveforms 
representing first and second statistical measures of first and second 
time distributions respectively of data volume in first and second 
directions in said data communications system. 

15 

23. The method of claim 21 wherein generating said first and second traffic 
waveforms comprises subjecting said first and second sets of traffic 
measurement values respectively, to a Discrete Wavelet Transform. 

20 24. The method of claim 23 wherein subjecting said first and second sets 

of traffic measurement values to said Discrete Wavelet Transform 
comprises using Haar wavelet filter coefficients in said Discrete 
Wavelet Transform. 



25 25. The method of claim 23 further comprising causing said Discrete 

Wavelet Transform to produce a first component, representing said first 
traffic waveform and a second component representing said second 
traffic waveform. 
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26. 



The method of claim 25 wherein producing said correlation value 
comprises correlating said first and second components. 
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27. The method of claim 25 further comprising implementing a traffic 
waveform generator in a processor circuit used to produce said 
correlation value. 

5 28. The method of claim 21 further comprising monitoring data in said first 

and second directions and producing said first and second sets of 
traffic measurement values respectively in response thereto. 

29. The method of claim 28 wherein producing said first and second sets of 
10 traffic measurement values comprises producing values representing a 

property of an Ethernet statistics group in a remote monitoring protocol, 
for each of said first and second directions. 

30. The method of claim 29 further comprising causing a processor circuit 
15 operable to produce said first and second traffic waveforms to 

communicate with a communication interface to receive said values 
representing a property of an Ethernet statistics group. 

31. The method of claim 28 wherein monitoring said data comprises at 
20 least one of: packet counters and octet counters in each of said first 

and second directions. 

32. The method of claim 28 further comprising causing a processor circuit 
operable to produce said first and second traffic waveforms to 

25 communicate with at least one of a packet counter and an octet 

counter to receive values representing said first and second sets of 
traffic measurement values. 



33. 
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The method of claim 32 further comprising causing said processor 
circuit to implement at least one of said packet counter and said octet 
counter. 
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The method of claim 28 further comprising passively monitoring said 
data in said first and second directions. 

A data communication method comprising transmitting and receiving 
data from a data communication system, the data communication 
method of claim 1 and further comprising signaling an operator in 
response to said bandwidth anomaly signal. 

A data communication method comprising transmitting and receiving 
data from a data communication system, the data communication 
method of claim 1 and further comprising controlling at least one of the 
transmission and reception of data from said data communication 
system in response to said bandwidth anomaly signal. 

An apparatus for detecting bandwidth anomalies in a data 
communication system, the apparatus comprising: 

means for receiving a first traffic waveform representing a time 
distribution of data volume in a first direction in said data 
communication system in a first period of time; 

means for producing a correlation value representing a 
correlation of said first traffic waveform with a reference 
waveform; and 

means for producing a bandwidth anomaly signal when said 
correlation value satisfies a criterion. 

A computer readable medium encoded with codes for directing a 
processor circuit to detect bandwidth anomalies in a data 
communication system, by: 



-36- 

receiving a first traffic waveform representing a time distribution 
of data volume in a first direction in said data communication 
system in a first period of time; 

producing a correlation value representing a correlation of said 
first traffic waveform with a reference waveform; and 

producing a bandwidth anomaly signal when said correlation 
value satisfies a criterion. 

A computer readable signal encoded with codes for directing a 
processor circuit to detect bandwidth anomalies in a data 
communication system, by: 

receiving a first traffic waveform representing a time distribution 
of data volume in a first direction in said data communication 
system in a first period of time; 

producing a correlation value representing a correlation of said 
first traffic waveform with a reference waveform; and 

producing a bandwidth anomaly signal when said correlation 
value satisfies a criterion. 

An apparatus for detecting bandwidth anomalies in a data 
communication system, the apparatus comprising: 

a processor circuit configured to: 

receive a first traffic waveform representing a time distribution of 
data volume in a first direction in said data communication 
system in a first period of time; 
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produce a correlation value representing a correlation of said 
first traffic waveform with a reference waveform; and 

produce a bandwidth anomaly signal when said correlation 
value satisfies a criterion. 

The apparatus of claim 40 wherein said processor circuit is configured 
to produce said bandwidth anomaly signal when said correlation value 
is less than a reference value. 

The apparatus of claim 41 wherein said processor circuit is configured 
to determine whether said correlation value is less than said reference 
value. 

The apparatus of claim 40 wherein said processor circuit is configured 
to receive a second traffic waveform representing a statistical measure 
of a time distribution of data volume in a second direction on said data 
communication system in a second period of time, and use said 
second traffic waveform as said reference waveform to produce said 
correlation value. 

The apparatus of claim 40 further comprising a first traffic waveform 
generator operable to receive a first set of traffic measurement values 
and to produce said first traffic waveform in response thereto. 

The apparatus of claim 44 wherein said first traffic waveform generator 
is configured to produce said first traffic waveform by subjecting said 
first set of traffic measurement values to a Discrete Wavelet Transform. 
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46. The apparatus of claim 45 wherein said first traffic waveform generator 
is configured to use Haar wavelet filter coefficients in said Discrete 
Wavelet Transform. 

5 47. The apparatus of claim 45 wherein said first traffic waveform generator 

is configured to cause said Discrete Wavelet Transform to produce a 
first component, said first component representing said first traffic 
waveform. 

10 48. The apparatus of claim 47 wherein said processor circuit is configured 

to produce said correlation value by correlating said first component 
with said reference waveform. 

49. The apparatus of claim 44 wherein said processor circuit is configured 
1 5 to implement said first traffic waveform generator. 

50. The apparatus of claim 40 wherein said first traffic waveform 
represents a statistical measure of a time distribution of data volume in 
said first direction. 

20 

51. The apparatus of claim 44 further comprising a communication 
interface operable to monitor data in said first direction and to produce 
said first set of traffic measurement values in response thereto. 

25 52. The apparatus of claim 51 wherein said communication interface 

produces values representing a property of an Ethernet statistics group 
in a remote monitoring protocol. 

53. The apparatus of claim 52 wherein said processor circuit is configured 
30 to communicate with said communication interface to receive said 

values representing a property of an Ethernet statistics group, said 
values representing said first set of traffic measurement values. 
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54. The apparatus of claim 51 wherein said communication interface 
includes at least one of a packet counter and an octet counter operable 
to count a corresponding one of packets and octets of data in said first 

5 direction. 

55. The apparatus of claim 54 wherein said processor circuit is configured 
to communicate with said communication interface to receive values 
produced by at least one of a said packet counter and said octet 

10 counter, said values representing said first set of traffic measurement 

values. 

56. The apparatus of claim 55 wherein said processor circuit is configured 
to implement said communication interface. 

15 

57. The apparatus of claim 51 further comprising a passive monitor 
operable to passively monitor said data in said first direction and to 
provide a copy of said data in said first direction to said communication 
interface. 

20 

58. A data communication apparatus operable to transmit and receive data 
from a data communication system, the data communication apparatus 
comprising the apparatus of claim 51 and further comprising a 
signaling device for signaling an operator in response to said 

25 bandwidth anomaly signal. 

59. A data communication apparatus operable to transmit and receive data 
from a data communication system, the data communication apparatus 
comprising the apparatus of claim 51 and further comprising a 

30 communication control device for controlling at least one of the 

transmission and reception of data from said data communication 
system in response to said bandwidth anomaly signal. 
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The apparatus of claim 43 further comprising a traffic waveform 
generator operable to receive said first and second sets of traffic 
measurement values and to produce said first and second traffic 
waveforms in response thereto. 

The apparatus of claim 60 wherein said processor is configured to 
receive first and second traffic waveforms representing first and second 
statistical measures of first and second time distributions respectively 
of data volume in first and second directions in said data 
communications system. 

The apparatus of claim 60 wherein said traffic waveform generator is 
configured to produce said first and second traffic waveforms by 
subjecting said first and second sets of traffic measurement values 
respectively, to a Discrete Wavelet Transform. 

The apparatus of claim 62 wherein said traffic waveform generator is 
configured to use Haar wavelet filter coefficients in said Discrete 
Wavelet Transform. 

The apparatus of claim 62 wherein said traffic waveform generator is 
configured to cause said Discrete Wavelet Transform to produce a first 
component, representing said first traffic waveform and a second 
component representing said second traffic waveform. 

The apparatus of claim 64 wherein said processor circuit is configured 
to produce said correlation value by correlating said first and second 
components. 

The apparatus of claim 64 wherein said processor circuit is configured 
to implement said traffic waveform generator. 
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67. The apparatus of claim 60 further comprising a communication 
interface operable to monitor data in said first and second directions 
and to produce said first and second sets of traffic measurement 

5 values respectively in response thereto. 

68. The apparatus of claim 67 wherein said communication interface 
produces values representing a property of an Ethernet statistics group 
in a remote monitoring protocol, for each of said first and second 

10 directions. 

69. The apparatus of claim 68 wherein said processor circuit is configured 
to communicate with said communication interface to receive said 
values representing a property of an Ethernet statistics group, for each 

15 of said first and second directions, said values representing said first 

and second sets of traffic measurement values respectively. 

70. The apparatus of claim 67 wherein said communication interface 
includes at least one of a packet counter and an octet counter operable 

20 to count a corresponding one of packets and octets of data for each of 

said first and second directions. 

71 . The apparatus of claim 67 wherein said processor circuit is configured 
to communicate with said communication interface to receive values 

25 produced by at least one of said packet counter and said octet counter, 

said values representing said first and second sets of traffic 
measurement values. 
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72. 



The apparatus of claim 67 wherein said processor circuit is configured 
to implement said communication interface. 
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The apparatus of claim 67 further comprising a passive monitor 
operable to passively monitor said data in said first and second 
directions and to provide copies of said data to said communication 
interface. 

A data communication apparatus operable to transmit and receive data 
from a data communication system, the data communication apparatus 
comprising the apparatus of claim 40 and further comprising a 
signaling device for signaling an operator in response to said 
bandwidth anomaly signal. 

A data communication apparatus operable to transmit and receive data 
from a data communication system, the data communication apparatus 
comprising the apparatus of claim 40 and further comprising a 
communication control device for controlling at least one of the 
transmission and reception of data from said data communication 
system in response to said bandwidth anomaly signal. 



